donutloader | f07d854d04a406a3506346f9e39c924865f8a9cd1b074629e1461f53bc247ea6

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 283KB
Sample260705-se5absc131
SHA256 f07d854d04a406a3506346f9e39c924865f8a9cd1b074629e1461f53bc247ea6
MD5 1e2550e348ce2b2662c30d06970bca1b
SHA1 387cdee0e3e0a9c5a5737d77eb19b2ad4c975ca7
SHA512 a42f45dd24c614e2ae59553a027af9e9eb7660a86711eca8ac45250a065525554f52448b8c5dcf51ee8e785fdf4550c0f5454520f9aa70a2530c9984240b7781
SSDEEP 3072:fsZHwWBXV+WISOMphc7/25Y4jcZSmh0WFS05e5HVmFYt1zDye0KGnX5/j25HEX9/:kZdmQY4oYmh5sJ/KGrK9z1zE8RLM0
TLSH
T13B548E5AF7A508FAEE77817CC9524601EA727C564760D6CF03A04AA72F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader loader spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3168-6-0x000002830CE20000-0x000002830CF31000-memory.dmp	family_donutloader

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 3168 created 5688	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3168 created 2364	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 3168 created 1764	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 3168 created 3924	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 3168 created 1468	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 3168 created 2964	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 3168 created 4676	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 3168 created 5688	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3168 created 5688	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 3168 created 3924	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 3168 created 3924	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 3168 created 1364	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 3168 created 1156	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	106
PID 3168 created 5784	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 3168 created 2492	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 3168 created 2728	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	108
PID 3168 created 4980	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	112
PID 3168 created 2944	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	114
PID 3168 created 1920	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 3168 created 1364	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 3168 created 1364	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 3168 created 5784	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 3168 created 5784	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	107

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_745610558\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_745610558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_1408171636\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_466636042\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_745610558\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_745610558\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_588526452\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_588526452\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_466636042\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3924	chrome.exe
5784	msedge.exe
5492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277374228839319"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{3960B661-A8A3-4756-B0E9-07C930186BBF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
1436	msedge.exe
1436	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe
Token: SeShutdownPrivilege	5688	chrome.exe
Token: SeCreatePagefilePrivilege	5688	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
5688	chrome.exe
1364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 5840	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 3168 wrote to memory of 5688	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 5688 wrote to memory of 2364	5688	chrome.exe	93
PID 5688 wrote to memory of 1764	5688	chrome.exe	94
PID 5688 wrote to memory of 1764	5688	chrome.exe	94
PID 5688 wrote to memory of 3924	5688	chrome.exe	95
PID 5688 wrote to memory of 1468	5688	chrome.exe	96
PID 5688 wrote to memory of 1468	5688	chrome.exe	96
PID 5688 wrote to memory of 4676	5688	chrome.exe	98
PID 5688 wrote to memory of 2964	5688	chrome.exe	97
PID 5688 wrote to memory of 4676	5688	chrome.exe	98
PID 5688 wrote to memory of 2964	5688	chrome.exe	97
PID 5688 wrote to memory of 2664	5688	chrome.exe	100
PID 5688 wrote to memory of 2664	5688	chrome.exe	100
PID 5688 wrote to memory of 3732	5688	chrome.exe	101
PID 5688 wrote to memory of 5456	5688	chrome.exe	104
PID 5688 wrote to memory of 5888	5688	chrome.exe	103
PID 5688 wrote to memory of 5456	5688	chrome.exe	104
PID 5688 wrote to memory of 5888	5688	chrome.exe	103
PID 3168 wrote to memory of 1364	3168	2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 1364 wrote to memory of 1156	1364	msedge.exe	106
PID 1364 wrote to memory of 5784	1364	msedge.exe	107
PID 1364 wrote to memory of 2492	1364	msedge.exe	109
PID 1364 wrote to memory of 2728	1364	msedge.exe	108
PID 1364 wrote to memory of 2492	1364	msedge.exe	109
PID 1364 wrote to memory of 2728	1364	msedge.exe	108
PID 1364 wrote to memory of 2728	1364	msedge.exe	108
PID 1364 wrote to memory of 4576	1364	msedge.exe	111
PID 1364 wrote to memory of 4576	1364	msedge.exe	111
PID 1364 wrote to memory of 4576	1364	msedge.exe	111
PID 1364 wrote to memory of 4980	1364	msedge.exe	112
PID 1364 wrote to memory of 4980	1364	msedge.exe	112
PID 1364 wrote to memory of 4980	1364	msedge.exe	112
PID 1364 wrote to memory of 1920	1364	msedge.exe	113
PID 1364 wrote to memory of 2944	1364	msedge.exe	114
PID 1364 wrote to memory of 1920	1364	msedge.exe	113
PID 1364 wrote to memory of 1920	1364	msedge.exe	113
PID 1364 wrote to memory of 2944	1364	msedge.exe	114
PID 1364 wrote to memory of 2944	1364	msedge.exe	114
PID 1364 wrote to memory of 1620	1364	msedge.exe	115
PID 1364 wrote to memory of 1620	1364	msedge.exe	115
PID 1364 wrote to memory of 1944	1364	msedge.exe	116
PID 1364 wrote to memory of 1944	1364	msedge.exe	116
PID 1364 wrote to memory of 5364	1364	msedge.exe	117
PID 1364 wrote to memory of 5364	1364	msedge.exe	117
PID 1364 wrote to memory of 5348	1364	msedge.exe	119
PID 1436 wrote to memory of 1784	1436	msedge.exe	122
PID 1436 wrote to memory of 5492	1436	msedge.exe	123
PID 1436 wrote to memory of 4888	1436	msedge.exe	124
PID 1436 wrote to memory of 4888	1436	msedge.exe	124
PID 1436 wrote to memory of 2180	1436	msedge.exe	125
PID 1436 wrote to memory of 2180	1436	msedge.exe	125
PID 1436 wrote to memory of 2180	1436	msedge.exe	125
PID 1436 wrote to memory of 4736	1436	msedge.exe	126
PID 1436 wrote to memory of 4736	1436	msedge.exe	126
PID 1436 wrote to memory of 4736	1436	msedge.exe	126
PID 1436 wrote to memory of 1440	1436	msedge.exe	128
PID 1436 wrote to memory of 1440	1436	msedge.exe	128
PID 1436 wrote to memory of 1440	1436	msedge.exe	128
PID 1436 wrote to memory of 4080	1436	msedge.exe	131
PID 1436 wrote to memory of 4080	1436	msedge.exe	131
PID 1436 wrote to memory of 1380	1436	msedge.exe	135
PID 1436 wrote to memory of 1596	1436	msedge.exe	136
PID 1436 wrote to memory of 1596	1436	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_1e2550e348ce2b2662c30d06970bca1b_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Prefetch\*.* > nul 2>&1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff93ab3c728,0x7ff93ab3c734,0x7ff93ab3c740
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1724,i,9051071498916503422,17033072979305696609,262144 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:1764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,3644328220312271739,3426702484223374417,524288 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,6926780784218523813,13749746431073028489,524288 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
    3⤵
    PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,17361972449070236079,13244653702269596691,2097152 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,641034993484757836,11780393711101943627,2097152 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,3598210087233880157,1344532372176951179,524288 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,12440282230759330822,6561160101060347476,524288 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:3732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5308,i,4091911589909485230,12793879260015263414,2097152 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5328,i,5670010789164566711,13796800389988429871,2097152 --field-trial-handle=1908,i,17256225491734429915,5822711956428149179,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff935a1c188,0x7ff935a1c194,0x7ff935a1c1a0
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,11659463590754464002,526669089906258446,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1588,i,7927084462569136338,5078867954745844702,262144 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,18299922082664978788,10307764459633772702,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,18034370745926698843,9032940160429809131,2097152 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4414925874465555664,1254854510556781945,2097152 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,3786066016489682282,9244367283208720096,2097152 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,13753416221459914768,13962496793911225834,2097152 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,5008104758307494521,16205440462021836929,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13305169181957033974,17125698255025247455,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,17523439912456800780,12285020734249389503,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,5781568894150509661,3875979567072222438,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,5781568894150509661,3875979567072222438,524288 --field-trial-handle=2572,i,2660102616491395036,12556611215659775221,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:5348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff935a1c188,0x7ff935a1c194,0x7ff935a1c1a0
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,8491668807804177303,1800198065321382089,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11795592309232199518,7851540528278867782,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,14123197803440240918,15406353330342175256,2097152 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:9
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16848614624201257441,5984835520308071547,262144 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4712,i,7232610291570142922,11350541960218689710,2097152 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,12515173812186189566,15473504797907017536,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4598979367310287993,15043617318577304201,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4598979367310287993,15043617318577304201,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2686135615038120478,6012312602185612810,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17782753401490888855,8423913632196951158,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,9380308560481515833,1398756730648990717,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,7111247887638849336,630104033998325313,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,12326820136340423474,12697561106778982065,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4061950904941056968,1280916011631125329,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,17341065108559067663,1055818795895623029,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,858202593489925889,7234855113832345754,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,17048242771379184965,4198737259026891453,262144 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,2442087892748183512,8852789851644289218,524288 --field-trial-handle=2296,i,13570149062083608891,12773033871767013306,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
  2⤵
  PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a0cb02807514fcc59db8d6c400aa761e234f4c0043f1a0fc7aa4d6626bbd0aaa
MD5 fad1709811870bc9d6c401a44bc8c83e
SHA1 f2a6216d9d1a89bd215bdb510e6e6e3a75d521da
SHA512 a9edc402e79db398788430226d8fe90a5a522716ed5375bfc74be796acd55a75696086253a5967ef00b9552bf3da5c93a2ffc3efd6e844fb83e56870d9697d9e
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O6o0Vummnlv:1nbZeMrv/hGt6opnV
TLSH
T10BD3764B3A747002DDE59A722CE050BB5E3CB16D4F5595D428B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c7031378a6fa035c2a70d20f2e5b8c42407e27194659cde5a75ff4c0bca0523d
MD5 6c2a9e91d5b74fc1353048f31f119820
SHA1 a85a989939c092bb43047c508fcfcc4a3ce98a8d
SHA512 79a55dbc09572ad639f1c512c55a788aff181b60fd239e7302dc6e892278d75f82ba5157714ed326ae745801184b6dfa9a5821f377f6f78b16ac9c34d1c68630
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbj5EsVRDotok5bxD6B6ydGyvyv1PWibmjiv4a:JC6PJX/dAeyt/3DUDlqFw7PWibqM
TLSH
T183A11972686C5DB358B2D089B9832F03CFA521979961EFC899EC4B1C05EB4E80343973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

5830c4ee-30bf-4ed6-8a69-b63ccbb3cb2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5830c4ee-30bf-4ed6-8a69-b63ccbb3cb2c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ac9f7bef1eab2d4b6eb32086b6bc9f6ca9825ec340b4d3058404be137f97c262
MD5 1e5bb10bd7538415a86b3d0641b6b3ed
SHA1 b669b11d6607f9684592e963ac46c4c7e0b74c82
SHA512 a301ba28cf023880be27784c67e6c80dc11d30385085dc6e87606abe3d19b12625a95b552758cb27a5384396968df1150f1818974408517a29ec4a85bb496950
SSDEEP 384:4beAxV/wKBdjfg6joNiqA/t7cJYJOEJrJtiRh6vdN:izl7fgkonA/t2
TLSH
T1E313E67EBB9BAE15C2C7443C43BB8B336770C724EAE1269347727930432935249AF599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 96176e504caaa5c81023e6b0fde0ca485a6710777f36f677015df39f27cd3ef2
MD5 bb73ea0d14d90f13a44b044054274550
SHA1 c7710238d994e8963bb596d916a87fd004549505
SHA512 a21a3caaa73aa7226256f2f9184fe9d99ede2ac59a34c2d53ffb189e3505e0455ef0481c780d64e0035c05da68bc7bde150fd62ef1a0bc9b1afabe8f61e997db
SSDEEP 1536:wugL/jNL/uL5kYUT9nbUnuOSWCN/abrsE9mxCudOnL/5ML/aL/:ML/BL/Zzlafsgmx8L/5ML/aL/
TLSH
T19A4460F70951A00BCBA842F5E2133E3DD177425D7DE2F8E9E2784C852929B21B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c43b8b243efa1d047db8b68152868b074541bda5a913e6911c46c3702e97ffa7
MD5 21501dd24de9a8fd1c9cf3d9198e03a4
SHA1 65ab28fef8f3b3ba2296b24debacb819ce25faa7
SHA512 73270d0ac2a5887e20ff4409b7d9ba2f38ece6a4b65250f988bc96f9b648a94bf89473a66d3bd3cfc5d38e14385d8670af3bccd53a18e335e44ddc33371e9a8a
SSDEEP 24576:sHUcOB8Vj6AXlguAEXqJ9Jg8cbmtk3cvDpZL6AvkDl8oK1U:suGpxOHEXqJ9FtkdAvkio
TLSH
T101167DEDCA7858C3CD73AA30B5F0E9477C7413C3F994C1D68898C584016BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 16dd7a3b9fb06d461382894e1946bffd6a2b8d5d3b846a2e80dc869523ec4260
MD5 aaba1fd72049545d52feca70af3307d7
SHA1 d4d3c4f453b4b9fd85259bd1cb0c3c81be7196cb
SHA512 86e1047c9f4ecc16d2fb4906549f52b65f929f5f5bd5ffa7b2d0332a4f14d910254851a254701df5744da181f48fa49e6a18308408c2abee3848c4be56adb437
TLSH
T1D871DAFA167F19A2C72741BE63EBE18B3B7088E731436E37DB189AF04755741416B060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f46a7e51dab3c39c53dffc7105776e5433576d3d363bc6dd7baa0056706cf9fe
MD5 4cc040150a5189bd726854c0d7ddd958
SHA1 c37ac9911506f182c59b97ec4ead443f2433f14c
SHA512 b700bb6d582da89b1f57a6b979f2dcf9802f8c7deffedd64a634a17d92284f6d7976e625fe97ebfb5193b4dc299a1b15765ae7cabed55f9da4d9d0688695b351
TLSH
T1F571DAFA167F19A2C72741BE63EBE19B3B7048E731036E37DB189AF00755741416B160
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 8275bf578b61fff6045db8d8a039a31f1c3d8095bda627e661fc881fd362fe69
MD5 ac31da392e2858e4c0d875e7269bb649
SHA1 e05d0df92af5e00d5379c1b181ae9c5987d30601
SHA512 18f2977f8a1fadfbe23a6898a465cca4efee270c984f2f44cb02ab9d8dc8633cd9da60bc64f571508412d5ce443cd1b85fd886fd0f6024ea4f7bb6dbfdd50cbb
TLSH
T196E0D89455CBC22D551138C24274BF19C2C03653D6856D07570088D5F603915BBC5D9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 5878ca9c6b3bee6e0a6248b3fe1377396656787db7298236c25f75a117d8c6fd
MD5 5297836ea213e7d760da756f245fd66c
SHA1 845fd195c633d79bffb38b18b3a6993f75ea4652
SHA512 375ea325e1629b6a29586c511c4e50b299e0e8f8dbb35b7b4ee7cba19e81d826d9d4ad55c844861a5e8b6cff7ccfa4d72ab33a44e6c9aae33707a984f042d5db
TLSH
T125E0261429CEC269505674D3C6E4E718C3D1761BE3883A025F0C888EF002508B39AAD6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 326B
SHA256 f26e46a1ccad924d821a9c08423ea972233feb22151c951cfc5fddb13e313e53
MD5 480acbf6f7d49dcb177628cbe07775f4
SHA1 2a9efcefb8a2f1b44f20eb1b4fe7cc0c2be97853
SHA512 30d3432d32faf539cc1f6ba174e377d5f869517ea87c08928f0f63d036fd57520c50eec98142f90e62ef648f04caa47a35228baf612462e9161e99ed84125333
TLSH
T127E0268819CEC269505778C3C2B4F72CC3D03653A28879025B08CC9DE00260CA782EE5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 1da7f4e69bcf6e45fb22fbe99f6dab87225a05bf71456346f74386654d06d466
MD5 2a0644b9bbb1d01ef45282158f1753ea
SHA1 70092a55deca1c3a99fe7eb754d227d3f21e4e15
SHA512 9393419c9e3304b00c725682e6ed07743fb857ca03b841116c65ce92f5ad20727243158884de910235d265d89cafa574c82ab1384bcec65b2c38aa06f2922c3b
TLSH
T146E0266407CBC2299024B8E783B8B71DD3D0367BE2883D021B088C55F103E49BB86AD6
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 c0d9b37b6f508eb37f3870889fff9728205e9b92002fbf5efbfc7f8e715fe86d
MD5 bee7bdf44452091c8754661be656d7b2
SHA1 48584488cbf98c3ca7f6a066a98af89681b37f4b
SHA512 9406a4887b466fcdd483a284f4ff27a6ba1e49c31df0d4bcaae84a28e4dfc45f38f87b3fd6ee2e23d4b008b24e8252d76f95ff20d710a951282c8e12fa6b432d
TLSH
T1A8E0D86146CEC25D510430CBC298BB08D3E0363BE6886A011B049C8AF006558B7A15D6
MD5 SHA1 SHA512 TLSH

Submit Download

86c2f2a3-df27-426b-895b-2f418f399e4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86c2f2a3-df27-426b-895b-2f418f399e4f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5adfcc134d94bd83e91500f6588ae5599d2b12b95b125aeb0ccbd517de30503c
MD5 9e2776ec88172e32e62de873f0bcf514
SHA1 85250c97f73176794a9973fafe1b7435248cf134
SHA512 ef4ec9169d76e739c47a0fb55df1167453b72dbcba742ceab417386ea649a085cbbcdeecbcf23d57d9d06a4055f30c2e55d40827e2536073c8b021d2b1ad7e6a
TLSH
T1ED41C0F7C3E8856EC90196F0BA186E2BCE2D0915832C3D5AC9E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 af027c44acf8ce62dc94944a55cc8068669c4955c4e7dbd83449ea26ac26d0b8
MD5 ef040bc42e54dd45ea6099d52f506167
SHA1 9bb120a9d1e5c18686171712f925847507f71de2
SHA512 e4b8d5a809550e6a8b192b432f0fb7b6ce777a7c87bf5db9369a2a0e959a52af85bad027ba10101fc3f894a60bc960e9775003e3224255d6c10abf47a2f8e1d7
SSDEEP 192:sxRzRZjeeqs3hH8ruZrMmIYCvllzoV8pi/g6+WNIY+kFhG0MIgZJ:sxRzXeeqsRwIrMmIYCHi/5I6FwD
TLSH
T16332B716A928A93B4CC7D219BB65BF53D2F91432A1D01E48FAFC871C05E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e777ce3d37efdac373b3473354b9b50b1ea792d7fdec5e7235724dc099dc63d9
MD5 ac88d2c1a1c0de77dc4b58d977859bf1
SHA1 5637c7a17ab34ecc275729a3b66a58853f68ab61
SHA512 a551d166b30f28ecf1d3404e99bf26c2b8532a6db2913a8eb28678401bd4bde00fcb107965ac5e8b5e5c70c43909a2bc9c3108fc0622ae6845b1ff89b8c0b41d
SSDEEP 192:sxRzRZjeeqs3hHaruZrMmIYCvllzoV8pi/g6+WNIY+FFhG0MIgbJ:sxRzXeeqsRmIrMmIYCHi/5IjFwt
TLSH
T11E32B716A928693B5CC7E219BB65BF53D2F91032A1D01E48FAFC871C06E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4a0059d21bb33d3274930ae78d3bbb0a5657d25038b869c6cf2a341cd746b9c9
MD5 553fabfb219a86d8334e665cda0f1ae6
SHA1 2a0004709cb7e2cc9b722c9786250ddd43052140
SHA512 68263ad776e482cf3788fe542dd1d0660a313a21238f4f2b3b93b1d6fac94ff336bfb3fc209d91f1a292b0acc6b7be86a44601312637cf5e7fbebe423cdd8dbe
SSDEEP 192:sxRoRZjeeqsChH8ruZrMmIYCvllzoV8pi/g6+WNIY+kFhG0MIgZJ:sxRoXeeqsOwIrMmIYCHi/5I6FwD
TLSH
T16E32A6166A28A93B4CC7E219BB65BF53D2F91432A1D41E48FAFC871C05E76DE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 425804a86d7401defb5ef485d48149bffdf22a13719056e0a190a8339a78e7b6
MD5 22c3951d861625a5b7128f01d8348d8d
SHA1 32a648fddedc471f249e38d895a40cc860108611
SHA512 a4ec8ed16ce2a0d972989e453cf000b52c58a72cf9dbe00d2b498bdddd1dc61f1c1c1cb608a50e44a8ff724ba311b8b812e2e142938f783504c80aae590a38f3
SSDEEP 768:7A6hzR7pLuL7xgWgEyf+w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvX+e00proskY:7A6hzHE7xgWgEyf+wu1jaUX+R0CpY
TLSH
T115D2F93B740CCB7F4F804ADDE8197A9B6D6802CB9698CD4447FA941C03C7BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d48973eaef62f7b608e6c4c13db4f8ab59f3583db3cd5be211c51242a59042c1
MD5 d7eeef0f6786feef47b40f676ddb2012
SHA1 36ee2ea0d87a99ac3a535c2a607c00aa06e9919c
SHA512 3e9283dde31dc5321716bad21932697c33cc8edf56862509ea34501f06d5193a1bf15c9fe5f482d8aa8357c36b417d2d0a5b404b72b0174a4eb881bcdcda1710
TLSH
T113E0DF140ACAD2B9701670C302A5E709C3E47E27D2C839062F009864E1C3908B793A90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 659B
SHA256 31f2ef73e14966b0c0572892a4ff21767721da0220ccba951a610469c4b12978
MD5 dadbb631b7e56d568bf5619aafcb5499
SHA1 a4be2dd95b2185074343f6fa51c77cc2dd007904
SHA512 192bca13df5343e004c204c71d295a9cb66a8a6e5f49893f6493a82ffa8a05798be4766b393d680c634817d1de057333b0473ed19da6e77097c7ba80c2e63ea2
TLSH
T1A60128D7DA49C426CDBD82B0068A7BE0A63685EC0ACCDCE7869D50D72082B377802907
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 ffa26e569d5b8a8131a9fb7b655808d008e32421d394bad097b3a66e86a93920
MD5 efa2175a8c3b091c86bce3cd76fce403
SHA1 4b2b584d82a9c8dddfe999caa1cebe6e1327f823
SHA512 98bc8aea776a82ca99cc57757961b349c75cc784c3076229898a5dcc2feef2539141dd802ffd19d4c3561038c711b1755f57346d4ce014141215b8b7838433b8
TLSH
T173E0266406CAC369521A74DB42A4BB0C93E03A33F7882D021702C488E202949F3E25E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3460ca3430ca68ed3c17b91a3b50c180cdea86e52e7b64207b90afbb71ad9c01
MD5 89d0e08f21e2b898ab8963ec29045025
SHA1 46b7f18c84ef8d95ca47a7e62fabe95a2da83ea6
SHA512 4425ccad30a3f7ecf8e7b6b9151e2ee4a32b6155f660e59516e96daa042f310fc902da353ca213fb92f16495070981db6e8e0fc73012cb48067c84bd951fcca8
TLSH
T182E0D82856CEC76E719670D74354F708C3E2BA17D6CA29112F08D48DE34754477439D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 194B
SHA256 f9a497be96dcab58091e4d5d2389fea3cf4fbde7f8e2e4abac7010cb35ca84ef
MD5 b3b74961bff7ab9fc0f4f3a57f637184
SHA1 1f77ba6e313bc4c498df1c7c4157d79e3df685bd
SHA512 7cedf227788ff68e18579e70187c3dff712652063f322be6eba969f768f719ae9ee7b52c721ce92b7717c29c7e58e480a8739cf862cef123b87ff0b11ebf3c2c
TLSH
T14AC04CD55A903023FDCA59390DAB53041B20C4752F74CE57D28430901C0A285FE61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 d3197f8d358045f36f833d6cd9532bd3ab50a15dc483e2a57b3553b34b83fe7d
MD5 6b226a9dfcb3839c9dc5b71f8f3013a8
SHA1 3006cc8dc61fde8560c84bd44316dbd98a594369
SHA512 20b13e044a472b7f4c7d5506f372c1c3f60faacb98e63cbfecf3c38b4bc690f5873760cb05eb5170ec70332af451cc5623a9dd1c2281bd842a5feaee999cb860
TLSH
T111E04FF49ACAC73A504AB0C382B4FB1ECBE07E17A7983A465B08C455F202558B7A69D4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3035c8f4b191c3ab1de326f1c14051dce47a22c827fdc1ceb039180a0e33199e
MD5 cf5b3edd9f18c7b3bfd7eec3f52fd517
SHA1 9527870816f23bfd390eb5bcc13c905d82173644
SHA512 6b9ed93a4dff0d087a4e20c89d98f7951b1e72348ef91ae9988a43257e3f694738b27451be89310c31db7f28922f069dd606c9b2c3071baa90195ddf390503e5
SSDEEP 96:KQQfeKIaO7neFK5y7KxC587FQYdGuImgPO6YqeLnOV65iLKxy5sLFgIN2/MN4cWP:TQfeKIaOLeFqygC58BQYdGuImgPO6YqR
TLSH
T191815B1773BA5B00387E354981F8D82F868138B27099A42B7B6A21E11F27E115FFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 52c51dcf81380c81d79d5e077a6c7a8d38d6e2088e8bd8594ed0e147fa5a2ca9
MD5 fe5b5e6ec5958a242f52ee3aca84ca4e
SHA1 05795eaf31a5efe93a33546703d490d52960413a
SHA512 2e47f4c5f6085400e403f10bae5e898ec17098a3f59fd6796e7c6d8925d585ca0f63aead1303046ec0bf18c3bfccba9f98abb3088e2b2a9b4b2ca32751b65519
SSDEEP 96:KQQfeKIaO7neFK5y7KxC587FQYdGuImgPO6YqeLnOV65iLKxy5sLFgIN2/MN4cWK:TQfeKIaOLeFqygC58BQYdGuImgPO6YqA
TLSH
T1F4913A2773B95B00387E354981F8D82F868138B27099A42B7B6A21E11F27D115FFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 399B
SHA256 541937998050a1eba857c8b6e1221b058ca69c75b5df911fe053a68582dff622
MD5 66955ff94fc16f68afa440bf8f39d65c
SHA1 fb8b25ecb3c5aaa392bddc63aecdc0ee7121c9f3
SHA512 ff69ec294d830a04cc3d7bb890c4fcc5712c003966827484f67deb4af5616b02fec99c066d15e31bc11df946043f6f426a16c295788db788194f7c39a765db1c
TLSH
T103E09B93236D74807ACDAA41C11C7C13A0C47EB6258E4471335E26A84B488196FADDB7
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 0b98267c288223e703e36d9bdea6dd8e05ebdb62b067745a47b0c1d1e07c7c1e
MD5 486e1c46bcad12c1dcc1a1318af8378e
SHA1 0bec84547232221e74899e345cb5c8d523eb20e0
SHA512 8b4f988825dd9c02f06f323a6bfb48cbd92e308cdb6821eaaadce71c66c92c4a7cb84a7956aa22357a504db587dd10d1fe081d8183be933b75053d5bd8399243
TLSH
T1BDF0A8DB6E021977CC0294315033AB83FB258ACB4424A4BB43CD212B1A2E2F1C9CC0E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 a408e7fac59d08277f000c8ba93ab80b328c570fb329d156e747d4d22e86a889
MD5 8bd123dfcbae23c33f6601b92fb48ca2
SHA1 cfa42e030f2159de95101837bc48dd3dac6ceecc
SHA512 c81d791b9f3fc5b1014e808eb9f39664103de8f50a44b78126d6d3418c52be7c1e584323c390ce684c18d2981c42cc55c0175306106c2058c40885118f9d3974
TLSH
T190E02690AACACA6FB45530C741B4B70EA3C03B33FAA829061F00C46CE006908BBE65D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9144cddaab748315d46242bd12fea4e1dcf91b2ca77e647ef729ab54b6075f2b
MD5 e523969c39d9f3acd63d1b9499848ed9
SHA1 235dd05c837761004ad006b992c08edd251717a1
SHA512 3283da3ce0a403db30912ff8fc701371dad88732ec2e223fb503c470671f2c0ce45c743486009cf9b8d3e445345d87ff6c7e1fce7d29d91c652802d8b5494fb5
TLSH
T10221D816F330C108E14A877DA47F9B250738E8568FBCED0F54B920756E75B481D4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 c61d5ada14471496654dcaf75681f3b705e4f356c53644000c940b68c793b7dd
MD5 0994173dbd481198863978e62378dc2d
SHA1 33466ac5728a7f4c20c84f64ed8c78456ee9a385
SHA512 9dcdd8b635d3e29bb067e86f8d5ebc2ee211dbfb261e876b37271f66a51bb069751e5256da3b0a15afd2d1669533e99db24af7b886b56f6e335de13a5056f838
TLSH
T156E02060E5C6C65F501130C341B4FB4D93D13A37FA982E011F04CC58D10E5497BCA5D2
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3b74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3b74.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d7eb57c3ae0b6916de0001eeb33c36f2c40ba5e25f43a5bf804d3d063081ec0b
MD5 f09af1385acb51734106c40cf5846a67
SHA1 3f0e71bfb4496f2c06deceed0a7db0834d0b45cd
SHA512 8143c2df4d08ffa20a7a7640ee30f901e21f9abd16b2ec48784d1df5c56c7fd03a38bd5fcc6f2d1b6ac6bed738b72cb401bf0ed1cd0ab41a2be279a8b0a6c764
SSDEEP 768:Orv+4UNbdp3yG5TEMcvnWgWWR+2SrXH78tRkf+8rr6F:Obsb/31EJPWg1bSro6Dr6
TLSH
T1FE03BF32A8689973DCE2DA85720B76037FF44183D6C91B88C4D91B4D829B9DE270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d9e85e503ac4ab50dc5deb4d9999703da5292513789e758e737111e461f0eb24
MD5 d6340c89b935734a2eb7bc6ea7945b36
SHA1 adcfe9c1c8fc9e81e51735dc06288dab79311560
SHA512 8674c5f69eaa1f741ff0c47dd84420fe980614c3fdf540ab6f39547bf14110a40fb83c12adb3fc22df994a0da9aae56e42444e5fa1f6ecaa054daca7587da545
SSDEEP 768:1j+9lrX5TRCTMcvnWgWWR+2SrXH78tRPkb9Mj:A9lRRCTJPWg1bSroQb+j
TLSH
T15DF2AE31A8655EB38DE2CA59B2067747BFF051DBC5CD1E88C8D95E0E02876ED170783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 947af4c56eb37a6778413ca74f2ec4fabb4a6f932e8bfb7847ec18f55189f6ce
MD5 a1c3cfc999a17aa716f0dbe2f5226c00
SHA1 8c90cdb1861085c027124f6a4c8811fb71f75bfe
SHA512 369e37f5a0f8fdd2d8433f632a4a1a15f7b53b8c46e2f7c8f7703d7eb44dad0f47e06ec49e6ea90ae4d891a36928ec7b50657cee0fd97ed1aa191e8545745786
SSDEEP 768:1j+9b3rX5TRCTMcvnWgWWR+2SrXH78tRPkb9Mj:A9b3RRCTJPWg1bSroQb+j
TLSH
T1DBF2AE31A8655EB38DE2CA59B2067747BFF051DBC5CD1E88C8D95E0E02876ED170783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d4c5eb0fe61f27509089e627bf51e605aad19e6b2b500317a8a632b408ea417b
MD5 e6bc70ceec61916e26a3476c3fefe1e3
SHA1 8c1c4c2b896a9a61d90dd45341523f6a14cf67ad
SHA512 3a32399d08bae1049f494f458244791c8bcffacbdbf2b128536ecfbe3ebd0424b116702c5437c654366e0fd8430298aa5487ca64c019df337190f17bf925d16e
SSDEEP 768:Vj+9lgp5TRvMcvnWgWWR+2SrXH78tRPdZ92O9Mj:g9lIRvJPWg1bSroR6O+j
TLSH
T17A03BF34AC155E7788EAEB44720E77576FE002BBC1E81D4CC2D45B0E82679ADF70382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 63cafbbf1c0db864336c948be7a78c11b500ddbe69b58dad3719cf0eedb09fe4
MD5 ed053f8a07cd3dd0e650d936ed827ca0
SHA1 3afea698773c40781aa9edc433c9f62cfae37781
SHA512 2d796490096a27cc305aa9e4c76707071b9152128a73752b1f7cc42201526a625830d063e839fbf33344d83741e71d0c7a218dc295d9e13af36bc97a9a9eaca9
SSDEEP 768:Orv+4UNbdp3lX5TRqMcvnWgWWR+2SrXH78tRFN+8rr6F:Obsb/3PRqJPWg1bSroLDr6
TLSH
T19103BE31A8689DB39DF2DE45B20BB603BFF41187D5C90B88C8D51A4E424B9DE270B977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 11687b04bc97e9b3826f29efa8d197c55e425a4f1f9f295b7fddc1fd9583678e
MD5 868fe0e8d5576f797122003879229a55
SHA1 9031d8a3fd7857f7cbcdeb62b022443efd497e0e
SHA512 a23e084cfdd61f44e6550f5bd48ef080923095947a5c24aa8bb11131d3d993a28085d612b900dd523b051b9a5f7e13da1b30688e232ad6fc0ddc97b4645f9f05
SSDEEP 768:Fj+9lgX5TRCTMcvnWgWWR+2SrXH78tRPkb9Mj:w9lSRCTJPWg1bSroQb+j
TLSH
T186F2AE31A8655EB38DE2CA59B2067747BFF051DBC5CD1E88C4D99E0E0287AED170783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 62KB
SHA256 7a4b3a9a90906f753df1de745ec5be6b2143da5fe3e6ef22a8bd6bb2c4ad0ea2
MD5 32557eb7f8dc1492ed4c2cc8b398c2aa
SHA1 6cece0ff648b9db9bdcc1559baf6b5d1d985e994
SHA512 f2feb44d5e405a376bb7d551cc4ecc5305fa559b691983183a3fd0e65d5b2f188df821b959d6c0b028f49be292a3b7bad9cb87576709bf71dfb76fa3babd0d0b
SSDEEP 1536:Q9lmJPWg1bSro7mZH8xnGySj3NQ/I0Ie61+j:QTmJP/goiZcxk7NkKO
TLSH
T1C853CF3AEC509E3F99FBDB85B2097A07AEE001FBC49C6DC8C6D84E1D41A71AD5307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

638e5651-797f-4409-af60-ae4c8d46291e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\638e5651-797f-4409-af60-ae4c8d46291e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

73264468

Path C:\Users\Admin\AppData\Local\Temp\33452d5a\73264468
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf911090-2743-4532-a631-e17664ddfe73.tmp

Path C:\Users\Admin\AppData\Local\Temp\cf911090-2743-4532-a631-e17664ddfe73.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 bc675759bbbd4e42a0551c85a1908dba444ad5edded57bd3e00fa93c54916163
MD5 a0d74185385a01b88c31da96b921cfd7
SHA1 b54e57009a52f9f8c1ea5afb3c4e92d7d82b8d3e
SHA512 102037022ad54a1654126b24369c8653731ece90fd5e5b1f7f6acf40e6a6e79d414cbfff7f31098370a97f65b1261d5041a7d5ab8141fd1ad149657562ef5c00
TLSH
T11321D6E13526237F6AC387D5A0760C951910F994432B5A8CEE4B5470EE5CEE0932EB8D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1436_925103278\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3168-7-0x000002830E110000-0x000002830E336000-memory.dmp

Download

memory/3168-6-0x000002830CE20000-0x000002830CF31000-memory.dmp

Download